Skip to main content

Integrate with OpenCloud

Support level: Community

What is OpenCloud?​

OpenCloud is an open-source content collaboration platform for storing, syncing, and sharing files, built on the Infinite Scale (oCIS) architecture.

-- https://opencloud.eu

Preparation​

The following placeholders are used in this guide:

  • opencloud.company is the FQDN of the OpenCloud installation.
  • authentik.company is the FQDN of the authentik installation.

This guide covers integrating authentik with the opencloud-compose Docker deployment. OpenCloud only supports authentication via OpenID Connect (OIDC).

Choose your setup below. The Web only tab logs in through the browser. The Web, desktop & mobile tab also enables the native sync clients, which each use a distinct client ID and require some extra issuer configuration.

authentik configuration​

Redirect URI changes in authentik 2026.5

In authentik versions earlier than 2026.5, all Redirect URIs are automatically treated as Authorization type. If you are using one of these older authentik versions, add only the Authorization URL to your Redirect URIs and do not configure a Post Logout URI.

  1. Log in to authentik as an administrator and open the Admin interface.
  2. Navigate to Applications > Applications and click New Application.
    • Application: provide a name and note the slug.
    • Choose a Provider type: select OAuth2/OpenID Connect.
    • Configure the Provider:
      • Client type: Public
      • Client ID: web
      • Redirect URIs:
        • Strict Authorization: https://opencloud.company/oidc-callback.html
        • Strict Authorization: https://opencloud.company/oidc-silent-redirect.html
        • Strict Authorization: https://opencloud.company/
      • Signing Key: select any available key.
      • Scopes: openid, profile, email.
  3. Click Submit.

OpenCloud configuration​

In the opencloud-compose project, enable the external IdP overlay in COMPOSE_FILE. This replaces OpenCloud's built-in IdP, so login goes through authentik only.

COMPOSE_FILE=docker-compose.yml:idm/external-idp.yml:custom/authentik-roles.yml

Set the OIDC values in .env:

OC_DOMAIN=opencloud.company
IDP_DOMAIN=authentik.company
IDP_ISSUER_URL=https://authentik.company/application/o/<application_slug>/
OC_OIDC_CLIENT_ID=web
OC_OIDC_CLIENT_SCOPES=openid profile email
WEBFINGER_WEB_OIDC_CLIENT_ID=web
WEBFINGER_WEB_OIDC_CLIENT_SCOPES=openid profile email

Create custom/authentik-roles.yml to assign every user the default role:

---
services:
    opencloud:
        environment:
            PROXY_ROLE_ASSIGNMENT_DRIVER: "default"
            GRAPH_ASSIGN_DEFAULT_USER_ROLE: "true"

Then reboot your Docker containers.

Configuration verification​

Open https://opencloud.company in a new browser window. You are redirected to authentik to log in, and after authenticating you are returned to OpenCloud.

Resources​